Up at 1am this morning and I just finished a major security overhaul to https://forecasted.money. While it still asks for your password to encrypt/decrypt your data, it actually stores a local key that you generate when you log in and uses that (instead) to create fresh AES-GCM keys when you encrypt/decrypt. Next step is automatic backups.